Security Advisories
Published OpenWISP security advisories and historical security fixes are listed below, most recent first. Follow the links for details and upgrade guidance.
2026-10-23, OpenWISP RADIUS (GHSA-hvmx-g7m2-vqx8): FreeRADIUS API can trust attacker-controlled forwarded IP addresses.
2026-10-23, OpenWISP Controller (GHSA-2x7f-qxwh-m483): Django admin allows cross-organization configuration access with a known UUID.
2026-10-23, OpenWISP Controller (GHSA-5c5w-h9xc-3mq5): REST API allows cross-organization configuration download with a known UUID.
2026-10-23, OpenWISP Controller (GHSA-rcf7-q946-fvpg): Shell injection in OpenWrt change_password() via unsanitized password fields.
2026-10-23, OpenWISP Controller (GHSA-9gh4-xw24-9xh5): CVE-2026-116677. CA CRL REST API does not scope requests to managed organizations. Fixed in 1.3.2. The practical severity is low because exploitation requires an authenticated organization manager with CA view permission and affects deployments that enable
DJANGO_X509_CRL_PROTECTED. CRLs are public by default through the standard django-x509 download endpoint.2026-10-15, OpenWISP RADIUS (GHSA-83gw-w3g2-6658): CSV batch imports can attach and delete users from other organizations.
2026-10-15, OpenWISP Controller (GHSA-4f2x-pxjx-h8m3): Stored XSS in template names can execute in administrator sessions.
2026-10-15, OpenWISP Controller (GHSA-39c4-xj33-j8j3): Device-location updates can access and transfer locations across organizations.
2026-09-15, OpenWISP RADIUS (GHSA-pfx3-4m53-g475): SMS verification bypasses destination and IP restrictions.
2026-06-15, OpenWISP IPAM (GHSA-x287-5c68-36wp): Broken object-level authorization allows exporting another organization's subnet and IP addresses.
2024-08-20, OpenWISP WiFi Login Pages: Replaced the compromised polyfill.io script source to prevent malicious JavaScript delivery.
2022-06-28, OpenWISP Users 1.0.2: Updated django-allauth to fix social-account linking CSRF and password-reset rate-limit bypasses.
2021-07-01, Ansible OpenWISP and Docker OpenWISP: Fixed nginx alias path traversal exposing files outside the static and media directories.
2021-04-09, OpenWISP Controller: Fixed internal HTTP endpoints exposing other organizations' UUIDs and sensitive information.
Announcements are also sent to the OpenWISP mailing list. To report a new suspected vulnerability privately, follow the instructions in Disclosing Vulnerabilities.